RE: FN-FORUM creating user using exec in PHP

date posted 8th January 2003 17:25

This is a multi-part message in MIME format.

------=_NextPart_000_0019_01C2B73A.FF809C00
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

You shouldn't. Very big security hole.
=20
What you should do is write the info to a database and then have a cron
running as root which reads the db and creates the users at least that
way the access to create users is not web accessible.
=20
=20

---
www.galcomp.net - Full Featured Web hosting
www.cvdb.info - Free CV storage and autoresponder
(ICQ#: 178070533)


-----Original Message-----
From: [EMAIL REMOVED]
[EMAIL REMOVED] On Behalf Of Nigell Boulton
Sent: 08 January 2003 13:46
To: [EMAIL REMOVED]
Subject: FN-FORUM creating user using exec in PHP


I am trying to create a user on my linux server using PHP. If i cut and
paste the string from $command2 into a SSH shell, it creates the
account. What kind of permissions should i run on this script.
=20

********************************************
Nigell Boulton
Naughty Mutt Ltd - Web and Graphic Design
http://www.naughtymutt.com
[EMAIL REMOVED]
01939 233116
********************************************


------=_NextPart_000_0019_01C2B73A.FF809C00
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable




Message





You=20
shouldn't. Very big security hole.
 
What=20
you should do is write the info to a database and then have a cron =
running as=20
root which reads the db and creates the users at least that way the =
access to=20
create users is not web accessible.
 
 
---www.galcomp.net - Full Featured Web=20
hostingwww.cvdb.info   - Free CV storage and=20
autoresponder(ICQ#: 178070533)


-----Original Message-----From:=20
[EMAIL REMOVED] =
[EMAIL REMOVED]
On Behalf Of Nigell BoultonSent: 08 January 2003=20
13:46To: [EMAIL REMOVED] =
FN-FORUM=20
creating user using exec in PHP
I am trying to create a user on my linux server using PHP. =
If i cut=20
and paste the string from $command2 into a SSH shell, it creates the =
account.=20
What kind of permissions should i run on this script.
 
<?
$command2=3D"useradd =
donkey.naughtymutt -g=20
naughtymutt";echo $command2;exec("$command2");
?>
********************************************Nigell=20
BoultonNaughty Mutt Ltd - Web and Graphic Designhttp://www.naughtymutt.com